CVE-2010-0040: Apple Safari

High severity, CVSS 9.3. EPSS: 6.5% chance of exploitation in the next 30 days.

Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.

Affected products

• Apple Safari: up to and including 4.0.4; version 4.0 only; version 4.0.0b only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only

Published 2010-03-15. Last modified 2026-06-16.